On Tue, May 20, 2025 at 12:58:40PM +0200, Phil Sutter wrote:
> Bump!
>
> Anything I can do to help push this forward? The series I submitted to
> add support for this to libnftnl and nftables should still apply as-is.
> Anything else missing on my end? Or should I try to break this down into
> smaller patches/chunks?
I was exactly now looking into integrating this into nf-next, sorry
for the slow turn around.
> Thanks, Phil
>
> On Tue, Apr 15, 2025 at 05:44:28PM +0200, Phil Sutter wrote:
> > Changes since v5:
> > - First part split into separate series (applied and present in Linus'
> > git already).
> > - Add nft_hook_find_ops_rcu() in patch 2 already to reduce size of patch
> > 5.
> > - New patch 4 to reduce size of patch 5.
> > - New patch 6 preparing for patch 7 which in turn combines identical
> > changes to both flowtables and netdev chains.
> >
> > Patches 1-5 prepare for and implement nf_hook_ops lists in nft_hook
> > objects. This is crucial for wildcard interface specs and convenient
> > with dynamic netdev hook registration upon NETDEV_REGISTER events.
> >
> > Patches 6-9 leverage the new infrastructure to correctly handle
> > NETDEV_REGISTER and NETDEV_CHANGENAME events.
> >
> > Patch 10 prepares the code for non-NUL-terminated interface names passed
> > by user space which resemble prefixes to match on. As a side-effect,
> > hook allocation code becomes tolerant to non-matching interface specs.
> >
> > The final two patches implement netlink notifications for netdev
> > add/remove events and add a kselftest.
> >
> > Phil Sutter (12):
> > netfilter: nf_tables: Introduce functions freeing nft_hook objects
> > netfilter: nf_tables: Introduce nft_hook_find_ops{,_rcu}()
> > netfilter: nf_tables: Introduce nft_register_flowtable_ops()
> > netfilter: nf_tables: Pass nf_hook_ops to
> > nft_unregister_flowtable_hook()
> > netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook
> > netfilter: nf_tables: Prepare for handling NETDEV_REGISTER events
> > netfilter: nf_tables: Respect NETDEV_REGISTER events
> > netfilter: nf_tables: Wrap netdev notifiers
> > netfilter: nf_tables: Handle NETDEV_CHANGENAME events
> > netfilter: nf_tables: Support wildcard netdev hook specs
> > netfilter: nf_tables: Add notications for hook changes
> > selftests: netfilter: Torture nftables netdev hooks
> >
> > include/linux/netfilter.h | 3 +
> > include/net/netfilter/nf_tables.h | 12 +-
> > include/uapi/linux/netfilter/nf_tables.h | 10 +
> > net/netfilter/nf_tables_api.c | 394 ++++++++++++++----
> > net/netfilter/nf_tables_offload.c | 51 ++-
> > net/netfilter/nft_chain_filter.c | 95 ++++-
> > net/netfilter/nft_flow_offload.c | 2 +-
> > .../testing/selftests/net/netfilter/Makefile | 1 +
> > .../net/netfilter/nft_interface_stress.sh | 151 +++++++
> > 9 files changed, 587 insertions(+), 132 deletions(-)
> > create mode 100755 tools/testing/selftests/net/netfilter/nft_interface_stress.sh
> >
> > --
> > 2.49.0
> >
> >
> >
